🛡️ Initial Incident Intake
This skill converts messy intake notes into a clear incident scope and evidence plan, speeding first-hour decision making.
npx playbooks add skill tsale/awesome-dfir-skills --skill initial-incident-intake
About Initial Incident Intake
The Initial Incident Intake skill is used to process disorganized intake notes and generate a concise incident scope and evidence plan, facilitating rapid decision making during the initial hour of incident response. It is designed to streamline the security incident intake process, enabling developers to quickly understand the scope of an incident and identify necessary evidence. This skill is typically utilized at the onset of a security incident to accelerate the decision-making process and ensure a timely response.
The 18-word prompt provides structured security guidance — covering detailed methodology and consistent output formats. Install it in one command.
Use Cases
- Auditing code for OWASP Top 10 vulnerabilities
- Implementing authentication and authorization patterns
- Reviewing API security, rate limiting, and input validation
- Hardening infrastructure and dependency security
Example Prompts
System Prompt (18 words)
This skill converts messy intake notes into a clear incident scope and evidence plan, speeding first-hour decision making.
Frequently Asked Questions
What is Initial Incident Intake?
Initial Incident Intake is a free security skill for AI coding agents. This skill converts messy intake notes into a clear incident scope and evidence plan, speeding first-hour decision making.. It provides a specialized system prompt that configures your agent with security expertise.
How do I use Initial Incident Intake with Claude Code?
Run npx playbooks add skill tsale/awesome-dfir-skills --skill initial-incident-intake in your terminal to install Initial Incident Intake into your Claude Code session. It works immediately after installation.
Which AI coding agents work with Initial Incident Intake?
Initial Incident Intake is compatible with Claude Code, Cursor, GitHub Copilot, Windsurf, OpenClaw, Cline, and any AI agent that supports custom system prompts or .cursorrules files.
Is Initial Incident Intake free to use?
Yes, Initial Incident Intake is completely free and open source. The full source is available on GitHub at https://github.com/tsale/awesome-dfir-skills/tree/main/skills/triage/initial-incident-intake/skill.md. You only need a subscription to the AI agent you use it with.
